Authorization program · Last verified
SecNumCloud
SecNumCloud is a French state qualification for cloud service providers, granted by ANSSI, covering SaaS, PaaS, CaaS and IaaS activities. The requirements framework is version 3.2 of 8 March 2022; conformity assessment is carried out by separate accredited bodies, not ANSSI itself.
- Class
- Authorization program
- Owner
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Public register
- Verified working
- Last verified
What it is
SecNumCloud is a French state qualification for cloud service providers, granted by ANSSI. ANSSI's own words: "La qualification SecNumCloud permet de reconnaître des offres cloud « de confiance » dont l'utilisation est préconisée pour la protection des données sensibles" — the qualification identifies "trusted" cloud offerings whose use is recommended for the protection of sensitive data. It rests on the requirements framework Prestataires de services d'informatique en nuage (SecNumCloud) — référentiel d'exigences, version 3.2 of 8 March 2022, and spans four service activities: SaaS, PaaS, CaaS and IaaS ("Les prestataires de services d'informatique en nuage sont qualifiés par l'ANSSI pour la fourniture des services suivants : SaaS … PaaS … CaaS … IaaS"). ANSSI grants the qualification "au titre de l'article 14 du décret n°2015-350"; conformity assessment is carried out by separate bodies (AFNOR Certification, BYCYB, Certi-Trust France, LSTI).
A previous, multi-level structure was withdrawn: the referential's own version history records, for version 3.1, the "retrait de la mention d'un niveau de qualification avancé" — the removal of an advanced qualification level. SecNumCloud does not currently publish levels.
Who owns it
SecNumCloud is granted by ANSSI, the French national cybersecurity agency.
Who assesses it
Conformity assessment is carried out by separate bodies from the authority that grants qualification. ANSSI's catalogue lists, under "Les organismes d'évaluation de la conformité": AFNOR Certification, BYCYB, Certi-Trust France, LSTI. ANSSI itself grants the qualification ("qualifiés par l'ANSSI au titre de l'article 14 du décret n°2015-350").
Who asks for it
ANSSI frames SecNumCloud as recommended rather than compulsory: the qualification marks offerings "dont l'utilisation est préconisée pour la protection des données sensibles". ANSSI's recommendations sit within the French state's own "Cloud au centre" doctrine, and its FAQ points to circulaire n° 6282-SG of 5 July 2021 as the instrument carrying that doctrine. Whether that circular obliges any body to buy a SecNumCloud-qualified service was not verified in the sources reviewed as of 29 August 2026 — the circular itself was not opened. Confirm against the circular and the buying authority.
Validity
La qualification est valable pour une durée de 3 ans mais est conditionnée par le respect des engagements du prestataire durant toute la durée de la qualification. Une fois la qualification octroyée, celle-ci est suivie au moyen d'audits annuels de surveillance. (ANSSI FAQ)
Sources
- ANSSI — SecNumCloud pour les fournisseurs de services cloud (scheme owner) ↗ — accessed
- ANSSI — Prestataires de services d'informatique en nuage (SecNumCloud) — référentiel d'exigences, v3.2, 8 March 2022 ↗ — accessed
- ANSSI — FAQ SecNumCloud (validity and annual surveillance) ↗ — accessed
- ANSSI — Catalogue produits, services, profils de protection, sites certifiés, qualifiés, agréés (August 2026) ↗ — accessed
Last verified:
This page is for information only; it does not accredit, certify or endorse any organisation. Requirements and programs change — always confirm against the primary source linked above.